Key Takeaways
- AI has cut the time needed to turn a theoretical security concept into a functional Proof of Concept (PoC) from months to days, accelerating research cycles.
- Shoham Danino’s career spans elite Israeli cyber training (Havazalot, Unit 8200) and leadership roles at Trustdome and Zscaler, giving him deep expertise in vulnerability research.
- Surf AI, founded in 2024 with ~70 employees, focuses on continuously eliminating exposure through a Context Graph, agentic workflows, and asset‑level context.
- The security research team follows a Mixture of Experts (MoE) model: six domain experts each own end‑to‑end projects while collaborating cross‑disciplinarily to solve complex challenges.
- Research output directly shapes Surf AI’s product in real time, with researchers responsible for concept, algorithmic design, and deployment.
- The team’s most valuable discoveries are not just new CVEs but automations that replace tedious, multi‑team workflows, delivering clear remediation steps.
- Danino’s personal “Moby Dick” is Stateless Hash‑Based Digital Signature Algorithms (SLH‑DSAs), reflecting his drive to tackle hard, unsolved problems.
- While competition in cybersecurity research is fierce and highly specialized, Surf AI’s edge lies in mapping non‑trivial relationships via its Context Graph architecture.
- AI frees researchers from implementation bottlenecks, allowing them to focus on deep creative thinking, contextual analysis, and solving the most complex security challenges.
Introduction: AI’s Impact on Security Research
AI is fundamentally transforming the security research landscape for the better, says Shoham Danino, Senior Researcher at cybersecurity startup Surf AI. He notes that the historic bottleneck for researchers—turning a theoretical concept into a functional Proof of Concept (PoC) to test a hypothesis—once required months of effort. Today, with AI‑assisted coding, automated testing, and rapid hypothesis generation, the same process can be completed in a matter of days. This acceleration enables teams to iterate on multiple ideas simultaneously, quickly converging on optimal solutions and preserving human cognitive bandwidth for higher‑order tasks such as creative threat modeling and contextual analysis.
Shoham Danino’s Background and Path to Vulnerability Research
Danino’s journey began with graduation from the elite Havazalot program, followed by nine years of service in various cyber roles within Israel’s renowned Unit 8200. After his military tenure, he spent four years at the startup Trustdome and later at Zscaler following its acquisition, rising to Director of Research. In that capacity he led both the Security Research and Data Science teams, driving technological innovation across Zscaler’s portfolio and co‑authoring over 20 patents. Academically, his work on a novel DNS server vulnerability method was presented at USENIX 2024, resulting in several global CVE disclosures. Danino attributes his specialization in vulnerability research to pure curiosity—a lifelong desire to understand how things work, whether a fax machine or a compiler.
Surf AI: Company Overview and Mission
Founded in 2024 by Yair Grindlinger (CEO), Elad Horn (CPO), Roie Cohen Duwek (CTO), and Brenton Gumucio (VP Customer Success), Surf AI now employs roughly 70 people. The company’s core proposition is to help organizations continuously eliminate exposure by leveraging its assets, a dynamic context graph, and agentic workflows. Rather than offering static scans, Surf AI builds a living map of an organization’s digital environment, enabling real‑time risk prioritization and automated remediation. This approach shifts security from periodic assessments to an ongoing, data‑driven process that adapts as assets and threats evolve.
Structure of the Security Research Team: Mixture of Experts Model
Surf AI’s security research team consists of six individuals: a team leader and five specialized domain experts, each with a distinct background. Danino describes the team’s organization as a Mixture of Experts (MoE) model. While each researcher acts as a “superstar” owner of an end‑to‑end project within their core discipline, the final solution always emerges from cross‑disciplinary collaboration. The premise is that today’s complex security challenges cannot be solved through a single lens; integrating multifaceted perspectives—such as networking, cryptography, data science, and behavioral analysis—is essential. This structure allows the team to tackle problems that require deep technical depth as well as broad systemic insight.
How the Research Team Drives Product Development
The research team functions as the beating heart of Surf AI, directly feeding the product development pipeline. Their primary responsibility is building and refining the Context Graph—a data structure that connects disparate telemetry, asset information, and threat intelligence to surface actionable, high‑value insights. Unlike traditional research groups whose outputs may sit in reports, Surf AI’s researchers hold end‑to‑end responsibility: they conceive ideas, design algorithms, implement prototypes, and shepherd the work into production. Positioned centrally within the company, they collaborate closely with engineering, ensuring that the product’s core capabilities are grounded in the latest research findings. Danino emphasizes that the synergy and workplace dynamics among team members are what make Surf AI’s offering truly exceptional.
Significant Discoveries and Customer Impact
While some of the team’s latest security discoveries remain under wraps pending coordinated disclosure, Danino highlights that the most impactful findings for customers are not merely new vulnerabilities. Instead, the team has succeeded in automating deeply entrenched operational roadblocks that have plagued the industry for years. By analyzing hundreds of thousands of findings, their system not only surfaces issues but also explains precisely how to resolve them, why specific tasks should be routed to particular individuals, and how to adapt the workflow in real time as conditions change. Seeing a client’s reaction when a previously chaotic, manual process becomes seamless automation is, for Danino, the most rewarding aspect of the work.
Personal Challenges and Competitive Landscape
When asked about his “Moby Dick,” Danino points to Stateless Hash‑Based Digital Signature Algorithms (SLH‑DSAs) as a compelling, unsolved problem that continues to intrigue him. Regarding competition, he characterizes the cybersecurity research arena as fiercely competitive yet highly differentiated. Many teams pursue similar macro‑level threats, but true distinction arises from hyper‑specific expertise. Surf AI’s advantage lies in its mastery of Context Graph architecture, which enables the team to map and analyze non‑trivial relationships between people, machines, and digital entities, isolating critical vulnerabilities that others might miss in the noise. Globally, few teams operate at this depth of relational analysis.
The Future of the Human Security Researcher in the Age of AI
Danino is optimistic about the role of human researchers despite AI’s rapid advances. He observes that AI has eliminated the implementation bottleneck that once forced researchers to spend months building PoCs, freeing them to focus on what humans do best: deep creative thinking, contextual research, and solving the most complex security challenges. By handling routine code generation, test automation, and hypothesis screening, AI augments human capacity, allowing teams to explore more ideas in parallel and converge on superior solutions faster. Ultimately, the synergy between AI‑driven efficiency and human ingenuity promises to elevate the effectiveness and relevance of security research in an increasingly automated threat landscape.